MikroTik

ScottReed

Lightning fast on my M1. So it could be some bug. Send more into to support No issues on my MacBook Pro M3 Pro. So yeah, something going on with the M2 Pro. I'll open a ticket. @normis - SUP-163597 I will send whatever you guys need and I will continue to dig on my end to see if I can sort it out.

ScottReed

Lightning fast on my M1. So it could be some bug. Send more into to support

No issues on my MacBook Pro M3 Pro. So yeah, something going on with the M2 Pro. I'll open a ticket.

ScottReed

Thank you for the native MacOS release. Unfortunately, it is terribly slow and clunky once you are connected to a device and the window is maximized . Main menu navigation and functionality seems to be fine. Issues only begin once you connect to a device. MacOS 14.6.1 on 2023 Mini M2 Pro Connecting ...

ScottReed

Throwing this out here to see if anyone else has experienced tx-drops on VLAN interfaces in CHR running in ESXi? The configuration is basically a vSwitch assigned with a single 10G port from an Intel XL710 adapter, MTU set to 1600 and promiscuous mode set to accept. Then a PortGroup configured using...

ScottReed

We were unable to get Hyper Threading disabled on Aptio BIOS v2.18.1263

The Advanced/CPU Configuration menu shows all grey options that cannot be modified. Surprisingly, Hyper Threading wasn't listed which is strange because the i7-7700 certainly supports it and it shows "enabled" in ESXi.

ScottReed

CHR 6.45.8 RouterMaxx Vengeance on ESXi 6.7U3 / i7-7700 / 32GB Using as an edge router connected to IX and ISP. 90+ BGP peering sessions. Partial routes from ISP. Any sort of load on any of the interfaces results in upwards of ~3000 tx-queue-drops-per-second. For example: /interface monitor-traffic ...

ScottReed

+1 for this feature.

ScottReed

I believe we resolved this problem by using dielectric grease on the Ethernet connection on the AF24HD radio side. I believe it is a similar problem to the one listed here: @mducharme - That article appears to be unrelated to what this topic is in regards to. The issue here is that we are logging '...

ScottReed

Did you find a solution for that problem? @Stril - No, I did not. We still have several AF links in the network which clock FCS errors at the Mikrotik devices. I believe we resolved this problem by using dielectric grease on the Ethernet connection on the AF24HD radio side. I believe it is a simila...

ScottReed

We have improved handling of operations on TILE based devices (CCRs). This fix will not affect anyone negatively, but might help in rare cases with different random problems. For example, there were users who used CCR1072 and CPU core was stuck on 100% usage due to IPsec HW encryption. This fix res...

ScottReed

Update. Went in today and disabled check-gateway on both of my 0.0.0.0/0 default routes. Ran an export while sniffing traffic and sure enough the misplaced ARP requests went out again. Proceeded to disable both the default routes. Again, ran the export while sniffing traffic and again I logged ARP r...

ScottReed

This is still an ongoing issue with no resolution. After many hours of troubleshooting, the "trigger" has been found to be caused by initiating a configuration export. /export compact file=export Without failure, every time the export is performed my upstream logs multiple misplaced ARPs. ...

ScottReed

Any check-gateway statements in /ip route with the gateway IP set to the wrong IP for the interface? I do not believe so. Here is the route export. IP's masked. 1.1.1.2 = gateway of ISP on sfp-sfpplus1 2.2.2.20 = gateway of ISP on sfp-sfpplus2 /ip route add check-gateway=ping distance=1 gateway=1.1...

ScottReed

CCR1072-1G-8S+ rOS 6.39.2 There is an ongoing ticket for this with Mikrotik but I thought I'd ask about it here too... I've masked the MACs and IPs for security purposes. One of my upstream providers alerted me of my router sending out ARP requests for an IP in a subnet attached to a different inter...

ScottReed

Does your IPv6 peering use link-local addressing or globally-unique (public) addressing? I've seen some issues with link-local next hop in ROS's IPv6 BGP. Thanks for the reply. Both my interface to the exchange and interface to Zayo have global IPv6 addresses. I'm in a /64 at the exchange and /126 ...

ScottReed

I am having a similar issue. CCR1072 rOS 6.37.4 Yesterday I tried to bring up a second session with Zayo for IPv6. Full routes from them and one advertisement from me. Within 3 minutes my routing table is empty and the network is completely down. My OSPF instance is also affected. I get BGP Hold Tim...

ScottReed

Unfortunately I think they won't implement it that fast.
This has been requested 7 (!!!!!) years ago, see viewtopic.php?t=43853

yeah, I know.

But, wishful thinking on my part. It can't hurt to hope!

ScottReed

What was the response?

Has been added to the feature request list.

I also requested that it be added to a 6.37.6(bugfix) if possible. So people still on 6.37 in production environments don't need to make a risky upgrade to an entire new release.

ScottReed

Email support@mikrotik.com with your feature request. That is the official channel.

Already done! Received response almost immediately.

ScottReed

Hey Mikrotik Support, bump on this one! We need SrcAS and DstAS exported from Traffic Flow.

Thanks.

ScottReed

I have a CCR1072 out in production that intermittently crashes and wanted to run the memory test on it. Booted into the RouterBOOT menu and I do not see option "t" to run the test. I've ran this test on other boards in the past so not sure if this is a feature that has been eliminated or s...

ScottReed

But it is worth to mention that this just will work in the meantime the device is not rebooted in which case it has to be applied again. This statement is correct. I had to reboot the affected router over the weekend and DHCP subsequently stopped working. I've setup a 'startup' scheduled script to ...

ScottReed

Problem in v6.38.5 also. Upgraded a CCR1036 this morning per Mikrotik support request on another issue entirely . DHCP stopped working after the update. Seeing " SERVER offering lease x.x.x.x without success" in log. I disabled RSTP on the bridge interface and the issue appears to be resol...

ScottReed

Well, Calix just informed us that their 801g ONT is fixed at 1496. So, that explains why i'm losing 4-bytes and fragmenting.

ScottReed

I am wracking my head against the wall on this issue for two days now. I cannot get 1500 byte MTU without fragmentation. 1496 is the cap. 4-byte difference has got to be q-in-q. I think? the resolution right now is to have customers set WAN port MTU to 1496. But, I'd like to nix this issue so that i...

ScottReed

Pantech UML295 LTE modem support appears to be broken in 6.36 on RouterOS x86. Downgraded back to 6.35.2. Yes There is issue with all simple CDC_Ether and RNDIS modems who uses web config in 6.36 we need to add exact ID for support. One client have already sent us Pantech UML295 LTE supout.rif fi...

ScottReed

Pantech UML295 LTE modem support appears to be broken in 6.36 on RouterOS x86.

Downgraded back to 6.35.2.

ScottReed

Sorry for bringing this old post back to life. We just recently were challenged to figure out a logging solution to see NATs. Specifically because of third party analytical firms like IP Echelon sending us emails about users downloading/sharing illegal content. So the question here is how do you gen...

ScottReed

Any word on adding SNMP Trap capability?

ScottReed

We had experiment those kind of issue with CCR and RB1100AHx2 few month ago, and then decide to put it on test in lab. Setup two airfiber with radio at very low power cause distance is about 20 meters in our warehouse. No FCS error at all for about two hours transmitting at 500/500 Mbps using BTest...

ScottReed

You've checked the obvious like the patch cord from ETHER6 to your switch? You've tried another port on your switch/RB? I took a look at your configuration and one thing I did notice is your switch configuration. I'm assuming you want all the ports ( except ETHER1 and the SFP ) in a switch configura...

ScottReed

did you try "print detail" and "print detail without-paging" ? Normis, thank you so much for your reply. Yes, I have. That works fine for preserving all the details, but the output is not in selectable columns. I could write some code to take the "print-details" output...

ScottReed

This is what you need - very nice feature really. http://wiki.mikrotik.com/wiki/Manual:Console_login_process Just use "admin+120w" as the username instead of "admin". Sam Thank you, but as stated in my OP, I already tried increasing the terminal width. It does not fix the issue ...

ScottReed

I assume that you are worried that some of the fields are not visible.? 'print details' outputs all parameters and doe snot truncate anything. First, thank you for your reply. It is much appreciated. Unfortunately, that is not the desirable output for this particular case. While 'print detail' does...

ScottReed

ScottReed

Setting flow control to "auto" on the CCR is not helping.

To those of you who were successful with this, are you also enabling flow control in the AF?

ScottReed

@bycabral - Can you confirm your success with Flow Control set to "auto"?

@vipnet - Please provide the source of this information. Who at UBNT told you they recalled Gen 1 AF's?

ScottReed

@bajodel

No, I do not. Only "Rx FCS Error"

ScottReed

@diegodriguez

Thanks for the suggestion. I thought you were on to something because I made these changes on one AF5 and one AF24 link and my FCS errors stopped. But only for seven minutes and then went back to the 1 minute intervals!!

So, back to square one.

ScottReed

UPDATE Yesterday we installed a brand new AF5 link. Included new cabling (UBNT ToughCable) and UBNT end connectors. The end at a CCR1036 is logging FCS Errors. The end at a RB1100 AHX2 is not logging FCS Errors. So the common denominator here is CCR. But, if you put a switch between the radio and t...

ScottReed

Not seeing any errors in the dmesg on any of the AF24 radios. 'ifconfig' is clean too. I use VLANs at the site routers, but on other interfaces where customer networks are configured. I do not have any tagged VLAN traffic leaving any of my routers. No VLANs on the interfaces where the AF24's are pat...

ScottReed

Yeah, they are in production. I don't have a choice really, as they are two main "arteries" back to my core router in locations where we need large available bandwidth. We are talking about doing some licensed links which would push one of these AF24 links into a higher path cost and becom...

ScottReed

No, no news. No fix. The issue is prevalent on CCR1016 and CCR1036 at my end. In an OSPF ring consisting of 2x 1016's and 1x 1036, they all log FCS errors on the ports in which the AF24's are attached. Furthermore, one of those aforementioned 1016's has an AF5 link to a RB1100. While the 1016 logs F...

ScottReed

Issue is still prevalent with all AF24, including replacements and brand new units.

ScottReed

When running this... /ip dhcp-server lease print file=dhcp_leases where ! dynamic and status="bound" The resulting file truncates the output and abruptly ends at column 80. I have tried via SSH with increased column width. Tried via Winbox terminal. Same results. If I run the command at th...

ScottReed

CCR1036-12G-4S... still happening with 6.27.

ScottReed

This would be a welcome addition.

+1

ScottReed

The IP addresses in your config don't match up to the IP's on your diagram for PPPoE Server and AP1. Also, you show no config for Router BTSC. Also, you specify a loopback (lo) but you never add its subnet to /routing ospf network . You should, as it will tie the lo interface to the default instance...

ScottReed

Hey @ibm - Sorry if I'm missing something here but which router is your core where your internet connection ties into your network? I'm assuming you're running a single OSPF instance all in the backbone area? The router which maintains the default route to the internet should be the only router and ...

ScottReed

What you are doing is not recommended. If you have a 10.0.0.0/8 subnet and you want it flat layer2 across your network, then why are you even using routers? You should have one core router with your internet connection and then just uplink to a switch and build off that across wireless links. Bear i...

ScottReed

I have struggled with OSPF across wireless links in my network for some time now. As stated in my original posts, I switched from BROADCAST to NBMA and it helped at the time. But, as I've upgraded RouterOS and upgraded AirOS, I've since reverted back to BROADCAST. The bottomline here is that the OSP...

ScottReed

@NathanA

I wish that was the case. I went into /tool user-manager router and ensured I had an entry for each external facing IP of each router.

ScottReed

@tonyd I had a CCR1016-12G with similar issues. I went to utilize port 12 and every time the port went active, the router rebooted and logged a kernel failure . At the time I was migrating to a CCR1036-12G-4S so I just went ahead and swapped the products. I took the 1016 back to the shop and was abl...

ScottReed

I have a test lab setup with three routers using OSPF. I'm currently working on a project to implement PPPoE authentication into our production network. One one router I am running UserManager and on the other two I have setup PPPoE Servers/Profiles and have opted to have the authentication requests...

ScottReed

@wispvt As stated in my post, I resolved this by replacing the 1200 with an 1100. I will also point out that this issue started to occur on more of my 1200's over the last six months. In every instance we just swapped with 1100's. Furthermore, the majority of the routers that did have the issue were...

ScottReed

This is still an issue.

Just got new CCR1036-12G-4S and cannot connect via MAC Winbox.

Same issue with my CCR1016

Have tried from multiple laptops.

ScottReed

Why am I seeing this? Doesn't appear to be causing me any problems, but it looks like it started AFTER rOS v6.11 http://theglobal.net/images/OSPFUnknown.jpg I am seeing this on RB1100 AHX2 running any rOS after v6.11 Typically in my situation this field would say "BROADCAST" Thanks, Scott

ScottReed

Thanks for the helpful post. This has been burning me for a while now. I had Cacti set for IN/OUT Bits Per Second Total Bandwidth and all my interfaces exceeding 100mbps were clipping. I had to go into Graph Management, select the device to filter, and then selected each interface and DELETE. I also...

ScottReed

FINAL POST The response that I got after weeks of troubleshooting, swapping radios, re-cabling, etc... I suggest to fill up an RMA for the device. You can check with your local reseller/distributor if they can help you with the RMA of the device. This response comes after they clearly knew I had sw...

ScottReed

As I stated earlier in the post - the issue is not related to Mikrotik. The original symptoms had me dead set that it was a CCR issue but after working through days of troubleshooting with UBNT and on my own, I have narrowed it down to the UBNT device - an AF24 in my case. UBNT has been working on t...

ScottReed

RouterOS downgrade did not fix it. I put a managed switch in between the AF 24 and the CCR. As stated by someone above, the switch begins to log errors on the port connected to the AF 24 and the issue is eliminated from the router. I went back to UBNT support on this and am awaiting a reply. This is...

ScottReed

@tgrand Interesting, but as @marcin21 points out, he has no problems with CCR on RouterOS v6.5. My scenario is very similar to his, I was also pushing 400-450mbps and no FCS Errors while on RouterOS v6.7 My problem started after the upgrade to v6.12 I will be downgrading next Monday and will post re...

ScottReed

@colinhowlin

Let me know what RouterOS v6.13 does for you. Also, if it has a new firmware upgrade in it too.

We get the FCS errors logged one a minute, both ends of the link.

CCR at root. RB1200 at remote.

Never saw these ever before until I upgraded the CCR to v6.12

Scott

ScottReed

ISSUE RESOLVED

I pulled the RB1200 and installed an RB1100AHx2 running RouterOS 6.10 and firmware 3.10 <--- SOLUTION

No issues for over 48 hours.

I will edit and mark solved once I feel the issue is gone.

ScottReed

This Thompson device, is it setup to terminate a PPPoE or PPPoA with a DSL provider? Is it setup as a bridge (non-router mode)? On your Mikrotik router, please ensure that your DHCP client is configured to "Add Default Route" set to YES. Make sure the DHCP Client is configured on the inter...

ScottReed

We use DLI products. Their Web Power Switch and PoE Switch POER24. http://www.digital-loggers.com/ Great products and will autoping devices and cycle power to specific ports on loss of ping. Whenever I remote upgrade a router I ALWAYS setup an autoping to it just in case the router doesn't come back...

ScottReed

@sasskass

I am aware of the changes to ethernet.

I am running firmware v3.13 as of the day I upgraded the CCR to v6.12

I have enabled flow control on both the AirFibers and on the CCR. Doesn't seem to help.

Thanks,
Scott

ScottReed

@IPANetEngineer The speed and duplex is matched at both ends using autonegotiation. I double checked to make sure the radios and the router interfaces are all 1000/FULL - and they are. There are no speed/duplex issues. I downgraded both AirFibers to 1.5. I continue to see one "FCS ERROR" p...

ScottReed

Issue is still prevalent. I downgraded from 6.11 to 6.10. Replaced the ethernet cable. Changed ports on the router. Changed ports on the PoE switch. Changed the patch cable. Changed the radio. Even went as far as disabling the EoIP tunnel on the interface. Ran great for seven hours and went down aga...

ScottReed

@n21roadie - Isn't that the truth now, isn't it!

I'm hoping some other people chime in here about this.

ScottReed

Thank you for your replies, but I'm not jumping on the "upgrade firmware" bandwagon anymore.

Per the release notes for v6.11 it was indicated that TX/RX Flow Control was added to ETHERNET. Obviously there is something more happening here which is affecting link state with the radios.

ScottReed

OK, slightly updated information to share. First of all, the CCR on v6.12 is logging hundreds of "fcs error on link" events. About one per minute. The problem started on 4/24/14 when I upgraded the CCR from v6.7 to v6.12. To be exact, it started at 11:22 exactly one minute after I upgraded...

ScottReed

Yes. RouterOS firmware updated.

ScottReed

Have an AF 24 link running v2.0 firmware. Root end terminated at a CCR1016-12G on RouterOS v6.12. Remote end terminated at a RB1200 on RouterOS v6.7. Using stock PoE injectors. UBNT ToughCable all within distance spec. Grounded. Since going to AF 24 v2.0 I'm seeing ridiculously high Rx FCS ERRORs an...

ScottReed

Recently upgraded six RB1200 routers to v6.11. Three went from v5.26 and three went from v6.7. Now, we experience unstable ethernet connectivity to Ubiquiti radios (NanoBridge and RocketM5). I am seeing negotiated link speed fluctuating from 100/FULL to 10/HALF to 10/FULL. Hard setting the radio and...

ScottReed

Mikrotik, are you investigating this?

If not then please provide me assistance with MPLS/VPLS configuration.

We continue to sink thousands of dollars into your gear and it's the least you could do.

Thanks,
Scott

ScottReed

Bysard - I hear ya' about RIP! Trust me, I'd use it exclusively if I could but I need the instantaneous fail over that OSPF provides. IPAN - In regards to MTU, that makes the most sense and we have already addressed that at a few locations but the problem persists. I'm assuming you are making refere...

ScottReed

When I say OSPF and no EoIP I basically mean a wireless link that does not have an EoIP tunnel configured between the two routers the link spans. That doesn't mean that either router doesn't have EoIP configured on another link. We do not use VLANs. The issue is prevalent across any links stemming f...

ScottReed

I have, but I have not tried it. I do not have any experience with that.

Do you mind maybe sharing your configuration? Just a snippet would be helpful.

Thanks,
Scott

ScottReed

That's a hard question to answer because of the diversity of sites we have and user levels. First off, we use EoIP to keep an old legacy layer 2 network running as we attrition people off to UBNT and onto our routed L3 network. So basically at most of our sites we have legacy gear + new gear and a r...

ScottReed

All - For months now we have been struggling with OSPF "flapping" where OSPF will simply lose adjacency with a neighbor and then come back up. I opened an issue with Mikrotik about it back in November and was told to upgrade to RouterOS v6.x. We have thirty+ routers, but I upgraded where I...

ScottReed

I know this is an older post, but we were struggling with the same issue of high latency across EoIP tunnels via wireless UBNT links. In a nutshell, we are using EoIP to tunnel legacy gear running in a flat layer 2 network across all our new routed links. After a lot of screwing around we found the ...

ScottReed

All - I have a fairly large network consisting of 26 Mikrotik routers, predominantly RB1200's. Not going to use real IP's below... Overview Each router has a 1.1.x.x/22 subnet off it and then we do 2.2.2.x/29 backhaul links off other interfaces and run OSPF. Some sites have redundancy, some do not. ...

ScottReed

bney - You may have just solved the SAME issue for me. I could not get OSPF to run over a PtP link with RocketM5's running v5.5.6 with multicast enabled in Advanced. Also have another PtP link with the same issue, RocketM5's running v5.5.4 - multicast enabled in Advanced. Changed to NBMA and right u...

ScottReed

Just found this: http://forum.mikrotik.com/viewtopic.php?f=14&t=70108 I changed the OSPF interface from Broadcast to NBMA. Appears to be working now... I have absolutely no clue why this would solve my issue, as I have used broadcast on all my links and run OSPF without issue. The PTP link consi...

ScottReed

We have been having some headaches with OSPF in our "backbone" area. About a year ago we started to route our network and began by installing an RB1200 at our largest tower site. Our "core" router is also an RB1200 and resides at our fiber handoff location. We built a dedicated w...

ScottReed

@deejayq - "get" works great, but how do I get all the entries in a list? I'm assuming some "for" loop?

@mrz - That's what I have been doing, but i'm tired of having to open an attachment on my phone when the message arrives.

Thanks,
Scott

ScottReed

Trying to do this: /tool e-mail send tls=yes to="someone@somewhere.com" subject="Current 172.30.6.0s-IN_USE" body="$[/ip firewall address-list print without-paging where list=172.30.6.0s-IN_USE]" Email comes through fine but BODY is empty. Instead, the printed output is...

ScottReed

I am building a network that currently has two remote sites and one main tower site where my fiber comes in and I am co-located. The remote sites will house access points for customer access. I'm trying to develop a plan to segment the customer traffic as to protect my management network. I have RB1...

ScottReed

Hi all - I have nine remote RB433's with HughesNet connections that I use EoIP tunnels to make a connection back to a central location for running Dude and admin purposes. Is there a way I can put all of this admin traffic across the EoIP tunnels into a single VLAN? Below is a snippet configuration ...

ScottReed

I have just performed the fw upgrade to 2.23 on one of the RB433's. Where are these fw upgrade changelogs kept? I poked around Mikrotik website but was unable to find any information.

Thanks,
Scott

ScottReed

Was onsite at one of the locations experiencing the problem and noticed that the Wireless Interface shows as enabled but not running under Interfaces. The only resolution is a reboot.

Please, any ideas?

Thanks,
Scott

ScottReed

I have 12 identical RB433's w/ R52h wifi cards. Running OS 4.5. Each RB433 has a HughesNet HN9000 on the Ether1 interface and the R52h hosting DHCP service and hotspot. Ether 2 and 3 disabled. In two of my locations I have consistently been experiencing an issue where the wireless interface stops re...

ScottReed

Bookmarked the link. Now this is starting to make sense!

Thank you very much for your help. I really appreciate it.

Scott

ScottReed

What you've shown me is exactly what I want. I appreciate your time. But, I do not know where you are grabbing that screen shot from. My User Manager 4.5 looks completely different. :? I access User Manager from http:// router ip /userman/ Is there another frontend that I am unaware of? Thanks, Scott

ScottReed

Please, anyone?

There must be away to modify the columns within User Manager when viewing/adding users.

Or, at a minimum, how can I dump a list of all the users with passwords in a clean CSV? Exporting from the terminal and then trying to delimit within Excel does not work well.

Thanks,
Scott

ScottReed

Am I missing something? :? Why can I not search by first / last name in User-Manager? I've seen older posts on here about the functionality working - but I cannot figure it out. Edit: And, that leads me to one other question: Why can you not choose which columns to display in the Users view? Thanks,

ScottReed

There are easy to follow docs on setting up the proxy in RouterOS. Just make sure you create a firewall filter rule to block access to port 8080 coming IN on your internet interface. Also, you will need to create a firewall nat rule to forward requests for port 80 to port 8080. This will create a tr...

ScottReed

This is not a question, but more a How-To on replicating a standard configuration to other routerboards. I'm putting this together because I had a real need for this in my application and I found some other posts from people receiving "short" answers and being told that the necessity to do...

ScottReed

Bax -

Thanks. No, I am not using PPP profile. I am using 'hotspot' profile for RADIUS.

ScottReed

I have installed User Manager, configured and used the local RADIUS server - configured per the documentation. When I create a User in User Manager can I use one of my two Hotspot User Profiles and assign it to the user? For example, I have two pre-defined profiles in /ip hotspot user profile and ea...

ScottReed

From what I can tell from your post, you don't have any Mikrotik products involved at your end at all. It appears that your T41 has an ISP provided PCMCIA card that establishes your internet connection. I would use ICS on the T41 and treat the WRT54G as a standard access point with switch instead of...

ScottReed

I finally got it to downgrade via the serial console. This probably would have worked from the beginning, but I could not connect to the router using the standard 115200 8N1 console config. Ended up working at 2400 8N1 - go figure. Not sure what sparked me to try this... I had another RB433 that I h...

ScottReed

Upgraded from 4.2 to 4.3 to check out the spectrum analyzer on my RB433. After reboot I am now experiencing intermittent ethernet connectivity on all three ports. Cannot MAC Telnet. Cannot access the device.

How can I downgrade without losing the config?

Thanks

ScottReed

/ip hotspot profile set default dns-name="" hotspot-address=0.0.0.0 html-directory=hotspot http-proxy=0.0.0.0:0 login-by=http-chap name=default rate-limit="" smtp-server=\ 0.0.0.0 split-user-domain=no use-radius=no add dns-name="" hotspot-address=0.0.0.0 html-directory...

ScottReed

Did some more messing around and found that if you create the rule as you initially stated and put it before the hotspot rules then it works as we expected and the subsequent hs-input rule is no longer even processing packets. Actually, the subsequent rule isn't even processing packets after the cli...

ScottReed

What version RouterOS are you using? 4.2 Can you post the output of "/ip firewall filter print all"? I'm curious what the differences are. Flags: X - disabled, I - invalid, D - dynamic 0 D chain=forward action=jump jump-target=hs-unauth hotspot=from-client,!auth 1 D chain=forward action=j...

ScottReed

Got it! You need to use hs-input for the chain!

/ip firewall filter chain=hs-input action=drop protocol=tcp src-address=!192.168.100.0/30 dst-port=21,22,23,80,443,8291,8728

ScottReed

It has something to do with the Hotspot. I disabled the Hotspot and the rule works as we expected it to.

I am going to keep digging.

ScottReed

I'll show the rules I added - anything else was added by the HS when I turned it on. I do not have an Mangle rules. Filter Rules - /ip firewall filter add chain=input action=drop protocol=tcp src-address=!192.168.100.0/30 dst-port=21,22,23,80,443,8291,8728 NAT Rules - this is the only one I added. T...

ScottReed

how simply can i configure a routerboard 433 with no wireless needed Don't buy a wireless mini-pci card for the RB433 and you won't have a wireless interface to configure. :D act like a simple router ADSL WAN on eth1 You will plug the DSL modem from the ISP into ether1 (if you are using PoE then yo...

ScottReed

OK, I removed the other rules and tried adding the new filter rule you provided. Same thing. It is processing packets but I can still access that page. Both ether2 (1.0/30) and wlan (20.0/27) are part of a hotspot profile. ether1 (0.0/30) is a HughesNet sat modem, the default gateway and is masquera...

ScottReed

I want to prevent access to the default MT Admin page that allows access to Webbox, Graphs, Winbox, Docs, etc... I changed /ip services so that Winbox, SSH and www are only available from my mgmt interface (ether3 100.0/30). The rest of the services are disabled. After doing that I could still acces...

ScottReed

I figured it out. The subnet mask of the Sat Modem is /30 (255.255.255.252) I setup the interface with the correct subnet and then turned on masquerading and everything is working perfect. /ip address add address=192.168.0.2/30 interface=ether1 /ip route add gateway=192.168.0.2 /ip firewall nat add ...

ScottReed

I am running RB433's with RouterOS 4.2. Migrating from old SOHO WiFi router's to the RB433 in seven locations with HughesNet installations. I cannot seem to get any of the ethernet ports to obtain an address from my HughesNet HN7000S or 9000 series sat modems. The dhcp-client is just in "Search...

ScottReed

Fewi -

Thanks. Moving the rules into the "Input" chain has worked. I am again processing my L7 rules.

Scott

ScottReed

Am running RouterOS 4.0 beta4. I have two L7 Protocols defined and two Firewall Filter Rules to go along. Both have been working fine. Today I enabled Web Proxy to begin blocking traffic to certain sites based on DNS names. I setup a new NAT rule to redirect packets through the proxy and I noticed t...

Search found 117 matches